I have the following code, that was working fine in Django 1.2.5:
from django.views.decorators.csrf import csrf_exempt
class ApiView(object):
def __call__(self, request, *args, **kwargs):
method = request.method.upper()
return getattr(self, method)(request, *args, **kwargs)
@csrf_exempt
class MyView(ApiView):
def POST(self):
# (...)
return HttpResponse(json.dumps(True), mimetype="text/javascript")
But when I upgraded to Django 1.4, I started to get a 403 forbidden, with a "CSRF verification failed" message.
Why is that @csrf_exempt decorator not working?
URL definition is:
from django.conf.urls.defaults import *
from django.views.decorators.csrf import csrf_exempt
import views
urlpatterns = patterns('',
url(r'^myview/(?P<parameter_name>[A-Za-z0-9-_]+)/$',
views.MyView(),
name="myproject-myapp-myview",
),
)
According to the django docs:
To decorate every instance of a class-based view, you need to decorate the class definition itself. To do this you apply the decorator to the dispatch() method of the class.
So you'd need to do something like:
class MyView(ApiView):
def POST(self):
# (...)
return HttpResponse(json.dumps(True), mimetype="text/javascript")
@csrf_exempt
def dispatch(self, *args, **kwargs):
return super(MyView, self).dispatch(*args, **kwargs)
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With